What is claimed is: 

1 . A method for verifying the legitimacy of an untrusted mechanism, 
comprising: 

submitting a first set of information and a second set of information to an 
untrusted mechanism in a sequence that is unpredictable to the untrusted mechanism; 

receiving a response from the imtrusted mechanism for each submission of 
either said first set of information or said second set of information; 

determining whether each response received from the untrusted mechanism is 
a correct response; and 

in response to a determination that any of the responses from the untrusted 
mechanism is an incorrect response, determining the untrusted mechanism to not be 
legitimate. 

2. The method of claim 1, wherein said sequence is generated randomly. 

3. The method of claim 2, wherein said sequence is generated using a 
random number generator. 

4. The method of claim 1, wherein said sequence includes at least one 
submission of said first set of information and at least one submission of said second 
set of information. 

5. The method of claim 1, wherein said first set of information is 
designed to solicit a first proper response from the imtrusted mechanism, and said 
second set of information is designed to solicit a second proper response from the 
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untrusted mechanism, and wherein detemiining whether each response received from 
the untrusted mechanism is a correct response comprises: 

where the set of information submitted to the untrusted mechanism was said 
first set of information, determining whether the response from the untrusted 
5 mechanism is said first proper response; and 

where the set of information submitted to the untrusted mechanism was said 
second set of information, determining whether the response from the untrusted 
mechanism is said second proper response. 

10 6. The method of claim 5, wherein said first proper response is an 

affirmative response, and wherein said second proper response is a negative response. 

7. A method for verifying the legitimacy of an untrusted signature 
verification mechanism, comprising: 
15 submitting a first signature and a second signature to an untrusted signature 

verification mechanism in a sequence that is unpredictable to the untrusted 
mechanism, said first signature being known to be verifiable, and said second 
signature being knovm to be unverifiable; 

receiving a response from the untrusted mechanism for each submission of 
20 either said first signature or said second signature; 

determining whether each response received from the untrusted mechanism is 
a correct response; and 

in response to a determination that any of the responses from the untrusted 
mechanism is an incorrect response, determining the untrusted mechanism to not be 
25 legitimate. 
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8. The method of claim 7, wherein said sequence is generated randomly. 

9. The method of claim 8, wherein said sequence is generated using a 
5 random number generator. 

10. The method of claim 7, wherein said sequence includes at least one 
submission of said first signature and at least one submission of said second signature. 

10 11. The method of claim 7, wherein determining whether each response 

received fi-om the untrusted mechanism is a correct response comprises: 

where the signature submitted to the untrusted mechanism was said first 

signature, determining whether the response fi-om the untrusted mechanism is that said 

first signature is verified; and 
15 where the signature submitted to the untrusted mechanism was said second 

signature, determining whether the response fi'om the untrusted mechanism is that said 

second signature is not verified. 

12. An apparatus for verifying the legitimacy of an imtrusted mechanism, 
20 comprising: 

a mechanism for submitting a first set of information and a second set of 
information to an untrusted mechanism in a sequence that is unpredictable to the 
untrusted mechanism; 

a mechanism for receiving a response fi-om the untrusted mechanism for each 
25 submission of either said first set of information or said second set of information; 
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a mechanism for determining whether each response received from the 
untrusted mechanism is a correct response; and 

a mechanism for determining, in response to a determination that any of the 
responses from the untrusted mechanism is an incorrect response, the untrusted 
mechanism to not be legitimate. 

13. The apparatus of claim 12, wherein said sequence is generated 
randomly. 

14. The apparatus of claim 13, wherein the mechanism for submitting 
comprises a random number generator. 

15. The apparatus of claim 12, wherein said sequence includes at least one 
submission of said first set of information and at least one submission of said second 
set of information. 

16. The apparatus of claim 12, wherein said first set of information is 
designed to solicit a first proper response from the imtrusted mechanism, and said 
second set of information is designed to solicit a second proper response from the 
imtrusted mechanism, and wherein the mechanism for determining whether each 
response received from the untrusted mechanism is a correct response comprises; 

a mechanism for determining, where the set of information submitted to the 
untrusted mechanism was said first set of information, whether the response from the 
untrusted mechanism is said first proper response; and 
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a mechanism for determining, where the set of information submitted to the 
untrusted mechanism was said second set of information, whether the response from 
the untrusted mechanism is said second proper response. 

5 17. The apparatus of claim 16, wherein said first proper response is an 

affirmative response, and wherein said second proper response is a negative response. 

18. An apparatus for verifying the legitimacy of an untrusted signature 
verification mechanism, comprising: 

10 a mechanism for submitting a first signature and a second signature to an 

untrusted signature verification mechanism in a sequence that is unpredictable to the 
untrusted mechanism, said first signature being known to be verifiable, and said 
second signature being known to be unverifiable; 

a mechanism for receiving a response from the untrusted mechanism for each 
15 submission of either said first signature or said second signature; 

a mechanism for determining whether each response received from the 
untrusted mechanism is a correct response; and 

a mechanism for determining, in response to a determination that any of the 
responses from the imtrusted mechanism is an incorrect response, the untrusted 
20 mechanism to not be legitimate. 

19. The apparatus of claim 18, wherein said sequence is generated 
randomly. 
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20. The apparatus of claim 19, wherein the mechanism for submitting 
comprises a random number generator. 

21 . The apparatus of claim 18, wherein said sequence includes at least one 
submission of said first signature and at least one submission of said second signature. 

22. The apparatus of claim 18, wherein the mechanism for determining 
whether each response resceived from the untrusted mechanism is a correct response 
comprises: 

a mechanism for determining, where the signature submitted to the untrusted 
mechanism was said first signature, whether the response from the untrusted 
mechaiusm is that said first signature is verified; and 

a mechanism for determining, where the signature submitted to the untrusted 
mechanism was said second signature, whether the response from the untrusted 
mechanism is that said second signature is not verified. 

23. A computer readable medium having stored thereon instructions 
which, when executed by one or more processors, cause the one or more processors to 
verify the legitimacy of an untrusted mechanism, said computer readable medium 
comprising: 

instructions for causing one or more processors to submit a first set of 
information and a second set of information to an untrusted mechanism in a sequence 
that is unpredictable to the untrusted mechanism; 
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instructions for causing one or more processors to receive a response from the 
untrusted mechanism for each submission of either said first set of information or said 
second set of information; 

instructions for causing one or more processors to determine whether each 
5 response received from the untrusted mechanism is a correct response; and 

instructions for causing one or more processors to determine, in response to a 
determination that any of the responses from the imtrusted mechanism is an incorrect 
response, the untrusted mechanism to not be legitimate. 

10 24. The computer readable medium of claim 23, wherein said sequence is 

generated randomly. 

25. The computer readable medium of claim 24, wherein said sequence is 
generated using a random number generator. 

15 

26. The computer readable medium of claim 23, wherein said sequence 
includes at least one submission of said first set of information and at least one 
submission of said second set of information. 

20 27. The computer readable medium of claim 23, wherein said first set of 

information is designed to solicit a first proper response from the untrusted 
mechanism, and said second set of information is designed to solicit a second proper 
response from the imtrusted mechanism, and wherein the instructions for causing one 
or more processors to determine whether each response received from the untrusted 

25 mechanism is a correct response comprises: 
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instructions for causing one or more processors to determine, where the set of 
information submitted to the untrusted mechanism was said first set of information, 
whether the response fi"om the untrusted mechanism is said first proper response; and 

instructions for causing one or more processors to determine, where the set of 
5 information submitted to the untrusted mechanism was said second set of information, 
whether the response fi-om the untrusted mechanism is said second proper response. 



28. The computer readable mediimi of claim 27, wherein said first proper 
response is an affirmative response, and wherein said second proper response is a 
10 negative response. 



29. A computer readable medium having stored thereon instructions 
which, when executed by one or more processors, cause the one or more processors to 
verify the legitimacy of an untrusted signature verification mechanism, said computer 

15 readable medium comprising: 

instructions for causing one or more processors to submit a first signature and 
a second signature to an untrusted signature verification mechanism in a sequence that 
is unpredictable to the untrusted mechanism, said first signature being known to be 
verifiable, and said second signature being known to be unverifiable; 

20 instructions for causing one or more processors to receive a response from the 

untrusted mechanism for each submission of either said first signature or said second 
signature; 

instructions for causing one or more processors to determine whether each 
response received from the untrusted mechanism is a correct response; and 
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instructions for causing one or more processors to determine, in response to a 
determination that any of the responses from the untrusted mechanism is an incorrect 
response, the untrusted mechanism to not be legitimate. 

5 30. The computer readable medium of claim 29, wherein said sequence is 

generated randomly. 

3 1 . The computer readable medium of claim 30, wherein said sequence is 
generated using a random number generator. 

10 

32. The computer readable medium of claim 29, wherein said sequence 
includes at least one submission of said first signature and at least one submission of 
said second signature. 

15 33. The computer readable medium of claim 29, wherein the instructions 

for causing one or more processors to determine whether each response received from 
the untrusted mechanism is a correct response comprises: 

instructions for causing one or more processors to determine, where the 
signature submitted to the untrusted mechanism was said first signature, whether the 

20 response from the untrusted mechanism is that said first signature is verified; and 
instructions for causing one or more processors to determine, where the 
signature submitted to the untrusted mechanism was said second signature, whether 
the response from the imtrusted mechanism is that said second signature is not 
verified. 
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